FFreedesktop

Products

Exploited and recent CVEs

• CVE-2026-107705 Medium 6.5 Poppler 0.42.0 through 26.10.0 Stack Buffer Overflow via Decrypt::revision6Hash() 0.3%
• CVE-2026-102621 Low 3.3 Freedesktop Poppler SplashClip.cc clipToPath integer overflow 0.1%
• CVE-2026-102620 Low 3.3 Freedesktop Poppler FoFiTrueType.cc cvtSfnts integer overflow 0.1%
• CVE-2026-93314 Medium 6.3 Freedesktop Poppler FoFiTrueType.cc mapCodeToGID integer overflow 0.2%
• CVE-2026-93313 Medium 6.3 Freedesktop Poppler JBIG2Stream.cc readCodeTableSeg integer overflow 0.2%
• CVE-2026-93312 Medium 4.3 Freedesktop Poppler JBIG2Stream.cc rewind null pointer dereference 0.4%
• CVE-2026-93311 Medium 4.3 Freedesktop Poppler SampledFunction Function.cc integer overflow 0.6%
• CVE-2026-50292 High 7.4 In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev properties leading to arbitrary root code execution 0.3%
• CVE-2025-43718 Low 2.9 Poppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply nested structures within the metadata (such as GTS_PDFEVersion) of a PDF document, e.g., a regular express 0.1%
• CVE-2025-52968 Low 2.7 xdg-open in xdg-utils through 1.2.1 can send requests containing SameSite=Strict cookies, which can facilitate CSRF. (For example, xdg-open could be modified to, by default, associate x-scheme-handler 0.2%
• CVE-2025-43903 Medium 4.3 NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify the adbe.pkcs7.sha1 signatures on documents, resulting in potential signature forgeries. 0.1%
• CVE-2025-32364 Medium 4.0 A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause an application to crash when handling malformed inputs associated with INT_MIN. 0.3%
• CVE-2025-32365 Medium 4.0 Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function in JBIG2Stream.cc because of a misplaced isOk check. 0.3%
• CVE-2020-16127 Low 2.8 accountsservice .pam_environment infinite loop 0.4%
• CVE-2020-16126 Low 3.3 accountsservice drops ruid, allows unprivileged users to send it signals 0.5%